Automated Reasoning Model Checking with SPIN (II) Alan Bundy - PowerPoint PPT Presentation

Automated Reasoning Model Checking with SPIN (II) Alan Bundy Automated Reasoning SPIN (II) page 1

Verifying Global Properties ● Assertions can be used to verify a property locally locally – For example, place assert(MemReturned) at the end of the process to verify that the requested memory has been returned before the process ends ● Some properties depend on non-local behaviour non-local behaviour of the model – For example, that the system never enters illegal states – or that it eventually enters the desired state ● Assertions alone are not not sufficient for verifying these properties ● A more powerful method is to use “never claims” Automated Reasoning SPIN (II) page 2

Never Claims ● Roughly, never claims are used to specify system behaviour which should never occur ● In Promela, a never claim can be declared by never { ... <Promela code> ... } ● When generating a verifier, Spin creates one (active) process for the never claim declared ● Verifier executes the never-claim process between every execution of other processes ● Verifier reports error if the never-claim process ends Automated Reasoning SPIN (II) page 3

Promela's goto Statement We might need to write loops in never claims. The simplest way is ● to use goto statement label_1: Labels mark locations in ● if the code (Note: a location :: p -> goto label_2 can have more than one label) :: else -> goto label_1 skip means “do nothing” fi; ● (usually needed because code label_2: cannot end with a label) skip goto statements redirect program execution to a labelled location ● in the code. So this code loops through label_1 as long as p is false ● – Where p is the property that is never meant to become true. Automated Reasoning SPIN (II) page 4

Promela's do Loop The do command is another way to write loops in Promela: do do :: p -> break ; :: guard -> statement; :: else -> skip ; :: guard -> statement; od ; od ; ● The guards function as in an if statement: one statement whose guard is true will be executed ● But unlike if statements, the do body repeats ● The do loop ends only if a break statement is reached (or if a goto statement is used) Automated Reasoning SPIN (II) page 5

Fred's Drinks Revisited mtype = { milk, lemonade, water }; bool bought_milk = false, bought_lemonade = false, bought_water = false; int num_drinks = 0; inline buy_item (a_drink, bought_a_drink) { ( item ==a_drink) -> bought_a_drink = true; Note: } num_drinks is proctype perhaps_buy (mtype item ) { now only atomic { incremented bool bought_something = true; when Fred buys if something. :: buy_item(milk, bought_milk); :: buy_item(lemonade, bought_lemonade); :: buy_item(water, bought_water); (This differs :: true -> bought_something = false; from fi; previously) if /* output what Fred bought, if anything */ :: bought_something -> printf("FRED BOUGHT "); num_drinks++; :: else -> printf("FRED DID NOT BUY "); fi; printm(item);printf("\n"); } } Automated Reasoning SPIN (II) page 6

Fred's Drinks Revisited II ● As an example, in Fred's Drinks model, never claims can be used to verify that Fred can never buy more than two kinds of drinks ● Desired behaviour: in all runs, num_drinks≤2 at all times, i.e. in all runs □ (num_drinks≤2) ● Forbidden behaviour: in some run, num_drinks>2 at some time, i.e. in some run  (num_drinks>2) Automated Reasoning SPIN (II) page 7

Fred's Drinks Revisited III ● Never claim for this property can be declared as follows: never { /* <>(num_drinks>2) */ do :: ((num_drinks>2)) -> break; :: else -> skip od } FredsNeverClaim ● do -loop exits and error is flagged whenever num_drinks becomes greater than 2 Automated Reasoning SPIN (II) page 8

Verifying a Never Claim Run spin -a -N <NeverClaimFile> <ModelFile> to generate ● a verifier % spin -a -N FredsNeverClaim FredsDrinks # build a verifier % cc -o pan pan.c # compile the verifier % ./pan -e # run, looking for errors pan: claim violated! (at depth 20) pan: wrote FredsDrinks1.trail % ./pan -r1 # examine the error ... FRED BOUGHT milk ... ... FRED BOUGHT lemonade ... ... FRED BOUGHT water ... 20: proc 0 (:never:) line 71 (state 8) -end- ... As expected, there's an error trail! ● If the condition is changed to num_drinks>3 , the verifier will ● produce no errors Automated Reasoning SPIN (II) page 9

Using LTL with Spin Spin can generate a never claim from the given LTL formula ● automatically Run spin -f '<LTLFormula>' . ● Spin's LTL syntax ● [] always ( □ ) eventually (  ) <> next ( X ) X logical negation ( ¬ ) ! strong until ( U ) U logical and ( ∧ ) && logical or ( ∨ ) || logical implication ( ⇒ ) -> <-> logical equivalence ( ⇔ ) Can use Promela variables or #define d symbols as propositions ● Automated Reasoning SPIN (II) page 10

Using LTL with Spin (cont) Example: ● % spin -f '<>p' never { /* <>p */ T0_init: if :: ((p)) -> goto accept_all :: (1) -> goto T0_init fi; accept_all: skip } Need to add definition for p separately, e.g. ● #define p (num_drinks>2) Automated Reasoning SPIN (II) page 11

The Bank Machine Revisited Model checking is often used to model dynamic systems, such as the bank machine from lecture 9: card cancel - inserted Enter card out Thanks, Welcome PIN Goodbye sufficient funds - wrong correct cash and card out ack problem - Try card out Amount? Sorry again We will represent this in Promela, using labels and goto , and then we will explore more complicated LTL claims. Automated Reasoning SPIN (II) page 12

Bank Machine Promela Model mtype = { S_Welcome, S_Enter_Pin, S_Try_Again, S_Amount, S_Thanks_Goodbye, S_Sorry } Labels correspond mtype state to states in our Bank Machine inline setState(x) { atomic { state = x; ... } automaton. } The description of active proctype BankMachineModel() { current state is s_welcome: setState(S_Welcome); recorded in a global printf("BANK [card inserted]\n"); variable state (for s_enter_pin: setState(S_Enter_Pin); if display). :: true -> { printf("BANK [wrong pin]\n"); goto s_try_again ; } Notice the non- :: true -> { printf("BANK [correct pin]\n"); deterministic goto s_amount ; } choices in if -block :: true -> { printf("BANK [cancel]\n"); goto s_thanks_goodbye ; } fi; s_try_again: setState(S_Try_Again) ; goto s_enter_pin ; s_amount: .... end: skip; BankMachine } Automated Reasoning SPIN (II) page 13

Bank Machine Runs card cancel - % spin BankMachine inserted Enter card out Thanks, Welcome BANK state is: S_Welcome PIN Goodbye BANK [card inserted] BANK state is: S_Enter_Pin sufficient funds - wrong BANK [correct pin] correct cash and card out ack BANK state is: S_Amount BANK [problem] BANK state is: S_Sorry problem - Try card out Amount? Sorry again BankMachine % spin BankMachine promela code BANK state is: S_Welcome BANK [card inserted] BANK state is: S_Enter_Pin BANK [wrong pin] % spin BankMachine BANK state is: S_Try_Again BANK state is: S_Welcome BANK state is: S_Enter_Pin BANK [card inserted] BANK [correct pin] BANK state is: S_Enter_Pin BANK state is: S_Amount BANK [cancel] BANK [sufficient funds] BANK state is: S_Thanks_Goodbye BANK state is: S_Thanks_Goodbye Automated Reasoning SPIN (II) page 14

Verifying Bank Machine ● Desired behaviour: all runs eventually reach S_Thanks_Goodbye or S_Sorry , i.e. all runs satisfies  (state==S_Thanks_Goodbye ∨ state==S_Sorry) ● Forbidden behaviour: some run remains in other states, i.e. some run satisfies □ ( state!=S_Thanks_Goodbye ∧ state!=S_Sorry) ● We cannot tell that a run is forbidden from any (initial) finite portion. (Something unexpected might happen after that!) Welcome, EP, TA, EP, TA,..., EP, Thanks_Goodbye n Automated Reasoning SPIN (II) page 15

Accept Cycles ● Can we write a never claim for this behaviour? Yes, but needs new error detection technique: accept cycles ● Accept labels : labels that begin with accept . e.g. accept , accept 1, accept _all, accept ing , ... ● Verifier flags errors if there is a run containing a cycle which goes through a location with an accept label ● Such a run goes through an accept label infinitely often ● Accept labels are normally used in never-claim blocks Automated Reasoning SPIN (II) page 16

Verifying Bank Machine (II) % spin -a -N BankMachineNever1 Define p and q and run ● BankMachine spin -f '[] ((!p) && (!q))' % cc -o pan pan.c % ./pan -e -a to generate never claim ... #define p state==S_Thanks_Goodbye pan: acceptance cycle (at depth 4) #define q state==S_Sorry pan: wrote BankMachine1.trail never { /* [] (!p && !q) */ ... errors: 1 ... accept_init: T0_init: % ./pan -r1 if ... :: (! ((p)) && ! ((q))) -> BANK state is: S_Welcome ... goto T0_init BANK [card inserted] ... fi; BANK state is: S_Enter_Pin ... } <<<<<START OF CYCLE>>>>> ... BankMachineNever1 BANK [wrong pin] ... Run verifier using pan -e -a to ● BANK state is: S_Try_Again ... detect accept cycles BANK state is: S_Enter_Pin ... Verifier finds a problematic infinite run where ● the wrong pin is entered over and over again! Automated Reasoning SPIN (II) page 17